Class 12

Roles

The Third-Party Application: "Client"

• The client is the application that is attempting to get access to the user's account. It needs to get permission from the user before it can do so.

The API: "Resource Server"

• The resource server is the API server used to access the user's information.

The Authorization Server

• This is the server that presents the interface where the user approves or denies the request. In smaller implementations, this may be the same server as the API server, but larger scale deployments will often build this as a separate component.

The User: "Resource Owner"

• The resource owner is the person who is giving access to some portion of their account.

Creating a web server app:

• redirect URIs - will only redirect users to a registered URI to protect users
• client ID and secret - client ID is public and used to build login URLs or included in JS source code. secret must be kept confidential.

Authorization

• several grant types: authorization code, password for logging in, client credentials
• end result is always to gain an access token

1. create a login link sending user to:

• https://authorization-server.com/auth?response_type=code& client_id=CLIENT_ID&redirect_uri=REDIRECT_URI&scope=photos&state=1234zyx

2. when user clicks the prompt allow, the service redirects the user back to your site with an auth code:

• https://example-app.com/cb?code=AUTH_CODE_HERE&state=1234zyx

3. server exchanges auth code for an access token:

• POST https://api.authorization-server.com/token
• grant_type=authorization_code&
• code=AUTH_CODE_HERE&
• redirect_uri=REDIRECT_URI&
• client_id=CLIENT_ID&
• client_secret=CLIENT_SECRET

4. server replies with an access token and expiration time:

• {
• "access_token":"RsT5OjbzRn430zqMLgV3Ia",
• "expires_in":3600
• }

5. Or, an error:

• {
• "error":"invalid_request"
• }